antisamy 0.0.1

data/LICENSE.txt

@@ -0,0 +1,20 @@
+Copyright (c) 2011 Sal Scotto
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.rdoc

@@ -0,0 +1,36 @@
+= Antisamy
+
+This project is a port of the java AntiSamy project to the ruby runtime. Its intended to provide a library for developers to add protection to their web applications from malicious
+user-supplier HTML and CSS. Please check out the AntiSamy project over at OWASP[http://www.owasp.org/index.php/Category:OWASP_AntiSamy_Project].
+
+== TODO
+
+* Add CSS scrubbing support
+
+== Synopsis
+
+	require 'antisamy'
+	policy = AntiSamy.policy('antisamy.xml')
+	tainted_html = 'User supplied markup'
+	scan_results = AntiSamy.scan(tainted_html,policy)
+	clean_html = scan_results.clean_html
+
+== Example Policies
+
+Please check policy-examples[https://github.com/washu/antisamy-ruby/tree/master/policy-examples] for sample policy files.
+
+== Contributing to antisamy
+
+* Check out the latest master to make sure the feature hasn't been implemented or the bug hasn't been fixed yet
+* Check out the issue tracker to make sure someone already hasn't requested it and/or contributed it
+* Fork the project
+* Start a feature/bugfix branch
+* Commit and push until you are happy with your contribution
+* Make sure to add tests for it. This is important so I don't break it in a future version unintentionally.
+* Please try not to mess with the Rakefile, version, or history. If you want to have your own version, or is otherwise necessary, that is fine, but please isolate to its own commit so I can cherry-pick around it.
+
+== Copyright
+
+Copyright (c) 2011 Sal Scotto. See LICENSE.txt for
+further details.
+

data/lib/antisamy.rb

@@ -0,0 +1,42 @@
+require 'nokogiri'
+require 'antisamy/model/attribute'
+require 'antisamy/model/tag'
+require 'antisamy/model/css_property'
+require 'antisamy/policy'
+require 'antisamy/scan_results'
+require 'antisamy/html/handler'
+require 'antisamy/html/sax_filter'
+require 'antisamy/html/scanner'
+
+module AntiSamy
+  class << self
+
+    # Setup the input encoding, defaults to UTF-8
+    def input_encoding=(encoding)
+      @@input_encoding = encoding
+    end
+
+    # Setup the output encoding defaults to UTF-8
+    def output_encoding=(encoding)
+      @@output_encoding = encoding
+    end
+
+    # Scan the input using the provided policy.
+    # will raise an exception if there is some form of scannign error
+    def scan(input,policy)
+      scanner = Scanner.new(policy)
+      @@input_encoding ||= Scanner::DEFAULT_ENCODE
+      @@output_encoding ||=  Scanner::DEFAULT_ENCODE
+      clean = scanner.scan(input,@@input_encoding, @output_encoding)
+      clean
+    end
+
+    # Create a policy out of the provided file
+    # will use a string or any IO object that can be read
+    # will raise an exception if the policy fails to validate
+    def policy(policy_file)
+      Policy.new(policy_file)
+    end
+
+  end
+end

data/lib/antisamy/html/handler.rb

@@ -0,0 +1,95 @@
+module AntiSamy
+
+  class Handler
+
+    attr_accessor :errors
+    def initialize(policy,output) #:nodoc:
+      @document = Nokogiri::HTML::DocumentFragment.parse("")
+      @current_node = @document
+      @policy = policy
+      @preserve_whitespace = @policy.directive(Policy::PRESERVE_SPACE)
+      @errors = []
+      @output_encoding = output
+    end
+
+    # HTML entity encode some text
+    def encode_text(text)
+      @document.encode_special_chars(text)
+    end
+
+    # create a cdata section
+    def cdata(text)
+      node = Nokogiri::XML::CDATA.new(@document,text)
+      @current_node.add_child(node)
+    end
+
+    # create a comment
+    def comment(text) #:nodoc:
+      @current_node.add_child(Nokogiri::XML::Comment.new(@document, text))
+    end
+
+    # create a text node
+    def characters(text)
+      node = @current_node.children.last
+      if node and node.text?
+        node.content += text
+      else
+        @current_node.add_child(Nokogiri::XML::Text.new(text, @document))
+      end
+    end
+
+    # start an element
+    def start_element(name,attributes)
+      elem = Nokogiri::XML::Element.new(name, @document)
+      attributes.each do |attrib_pair|
+        elem[attrib_pair.first] = attrib_pair.last
+      end
+      # Special param tag hacking, as libxml/nokogiri doesnt generate an end tag
+      # for param tags it seems
+      if name.eql?("param")
+        inner_html = "<param"
+        attributes.each do |attrib_pair|
+          inner_html<< " #{attrib_pair.first}=\"#{attrib_pair.last}\""
+        end
+        inner_html << "/>"
+        # we create a fake cdata node, add it *and* dont move our parent yet
+        elem = Nokogiri::XML::CDATA.new(@document,inner_html)
+        @current_node.add_child(elem)
+        return
+      end
+      @current_node = @current_node.add_child(elem)
+    end
+
+    #end an element
+    def end_element(name)
+      if @current_node.nil? or !@current_node.name.eql?(name)
+        return
+      end
+      @current_node = @current_node.parent if @current_node.parent
+    end
+
+    # format the output applying any policy rules
+    def document
+      # check some directives
+      indent = 0
+      options = Nokogiri::XML::Node::SaveOptions::NO_EMPTY_TAGS
+      if @policy.directive(Policy::FORMAT_OUTPUT)
+        options |= Nokogiri::XML::Node::SaveOptions::FORMAT
+        indent = 2
+      end
+      if @policy.directive(Policy::OMIT_DOC_TYPE) || @policy.directive(Policy::OMIT_XML_DECL)
+        options |= Nokogiri::XML::Node::SaveOptions::NO_DECLARATION
+      end
+
+      clean = ""
+      if @policy.directive(Policy::USE_XHTML)
+        options |= Nokogiri::XML::Node::SaveOptions::AS_XHTML
+        clean = @document.to_xhtml(:encoding => @output_encoding, :indent=>indent,:save_with=>options)
+      else
+        clean = @document.to_html(:encoding => @output_encoding, :indent=>indent,:save_with=>options)
+      end
+      return clean
+    end
+
+  end
+end

data/lib/antisamy/html/sax_filter.rb

@@ -0,0 +1,286 @@
+module AntiSamy
+  # Quick and Dirty Stack class
+  class Stack
+    def initialize
+      @stack = []
+    end
+    # push an emement ont he stack
+    def push(v)
+      @stack.push v
+    end
+    # pop an element off the stack
+    def pop
+      @stack.pop
+    end
+    # size of stack
+    def size
+      @stack.size
+    end
+    # is the stack empty
+    def empty?
+      @stack.empty?
+    end
+    # peek to see what next element is
+    def peek?(v)
+      return false if @stack.empty?
+      return @stack.last.eql?(v)
+    end
+
+    def peek
+      @stack.last
+    end
+
+  end
+
+  class SaxFilter < Nokogiri::XML::SAX::Document
+    def initialize(policy,handler,param_tag)
+      @policy = policy
+      @handler = handler
+      @stack = Stack.new
+      @css_content = nil
+      @css_attributes = nil
+      @css_scanner = nil
+      @param_tag = param_tag
+    end
+
+    def error(text)
+      #puts "SAX Error #{text}"
+    end
+
+    def warning(text)
+      puts "SAX Warning #{text}"
+    end
+
+    # Always create a HTML document unless the DECL was set beforehand
+    def start_document
+    end
+
+    # Add a comment block
+    def comment(text)
+      return if text.nil?
+      if @policy.directive(Policy::PRESERVE_COMMENTS) =~ /true/i
+        # Strip out conditional directives
+        text.gsub!(%r{<!?!\[(?:end)?if*\]}ixm,"")
+        text.gsub!(%r{\[(?:if).*\]>},"")
+        @handler.comment(text)
+      end
+    end
+
+    def convert_array(x)
+      if x and x.first.is_a?(Array)
+        return x
+      end
+      i = 0
+      h = []
+      while i < x.size
+        m = []
+        m[0] = x[i]
+        m[1] = x[i+1]
+        h << m
+        i += 2
+      end
+      h
+    end
+
+    def fetch_attribute(array,key)
+      array.each do |pair|
+        if pair.first.eql?(key)
+          return pair.last
+        end
+      end
+      nil
+    end
+
+    # Start an element,
+    def start_element(name, attributes = [])
+      attributes = convert_array(attributes)
+      o_attributes = attributes.dup
+      tag = @policy.tag(name)
+      masquerade = false
+      embed_name = nil
+      embed_value = nil
+      # Handle validate param tag as an embed tag
+      if tag.nil? && @policy.directive(Policy::VALIDATE_P_AS_E) && name.eql?("param")
+        embed = @param_tag
+        if @policy.tag("embed")
+          embed = @policy.tag("embed")
+        end
+        if embed and embed.action == Policy::ACTION_VALIDATE
+          tag = embed
+          masquerade = true
+          embed_name = fetch_attribute(attributes,"name")
+          embed_value = fetch_attribute(attributes,"value")
+          attributes = [ [embed_name,embed_value] ]
+        end
+      end
+      valid_attributes = []
+      if @stack.peek?(:css) or @stack.peek?(:remove)
+        # We are in remove mode to remove this tag as well as any child style elements if css mode
+        @stack.push(:remove)
+      elsif (tag.nil? && @policy.directive(Policy::ON_UNKNOWN_TAG).eql?("encode")) or (!tag.nil? && tag.action.eql?(Policy::ACTION_ENCODE)) or @policy.encode?(name.downcase)
+        tmp = "<#{name}>"
+        @handler.characters(tmp)
+        @stack.push(:filter)
+      elsif tag.nil?
+        @handler.errors << ScanMessage.new(ScanMessage::ERROR_TAG_NOT_IN_POLICY,name)
+        @stack.push(:filter)
+      elsif tag.action.eql?(Policy::ACTION_FILTER)
+        @handler.errors << ScanMessage.new(ScanMessage::ERROR_TAG_FILTERED,name)
+        @stack.push(:filter)
+      elsif tag.action.eql?(Policy::ACTION_VALIDATE)
+        # Handle validation
+        is_style = name.include?("style")
+        if is_style
+          @stack.push(:css)
+          @css_content = ''
+          @css_attributes = []
+        else
+          # Validate attributes
+          remove_tag = false
+          filter_tag = false
+          attributes.each do |pair|
+            a_name = pair.first
+            a_value = pair.last
+            attrib = tag.attribute(a_name.downcase)
+            if attrib.nil?
+              attrib = @policy.global(a_name.downcase)
+            end
+            # check if the attribute is a style
+            if a_name.eql?("style")
+              # Handle Style tags
+              # begin
+              #   results = @css_scanner.scan_inline(a_value,name,@policy.max_input)
+              #   valid_attributes << [a_name,results.clean_html]
+              #   @handler.errors << results.errors
+              #   @handler.errors.flatten!
+              # rescue Exception => e
+              #   @handler.errors << ScanMessage.new(ScanMessage::ERROR_CSS_ATTRIBUTE_MALFORMED,name,@handler.encode_text(value))
+              # end
+            elsif !attrib.nil? # Attribute is not nil lets check it
+              valid = false
+              attrib.values.each do |av|
+                if av.eql?(a_value)
+                  valid_attributes << [a_name,a_value]
+                  valid = true
+                  break
+                end
+              end
+              unless valid
+                attrib.expressions.each do |ae|
+                  if a_value.downcase =~ ae
+                    valid_attributes << [a_name,a_value]
+                    valid = true
+                    break
+                  end
+                end
+              end
+              # we check the matches
+              if !valid && attrib.action.eql?(Attribute::ACTION_REMOVE_TAG)
+                @handler.errors << ScanMessage.new(ScanMessage::ERROR_ATTRIBUTE_INVALID_REMOVED,tag.name,@handler.encode_text(a_name),@handler.encode_text(a_value))
+                remove_tag = true
+              elsif !valid && attrib.action.eql?(Attribute::ACTION_FILTER_TAG)
+                @handler.errors << ScanMessage.new(ScanMessage::ERROR_ATTRIBUTE_CAUSE_FILTER,tag.name,@handler.encode_text(a_name),@handler.encode_text(a_value))
+                filter_tag = true
+              elsif !valid
+                @handler.errors << ScanMessage.new(ScanMessage::ERROR_ATTRIBUTE_INVALID,tag.name,@handler.encode_text(a_name),@handler.encode_text(a_value))
+              end
+
+            else # attribute was null
+              @handler.errors << ScanMessage.new(ScanMessage::ERROR_ATTRIBUTE_NOT_IN_POLICY,tag.name,a_name,@handler.encode_text(a_value))
+              if masquerade
+                filter_tag = true
+              end
+            end
+          end # end attirubte loop
+        end
+        if remove_tag
+          @stack.push(:remove)
+        elsif filter_tag
+          @stack.push(:filter)
+        else
+          if name.eql?("a") and @policy.directive(Policy::ANCHROS_NOFOLLOW) =~ /true/i
+            valid_attributes << ["rel","nofollow"]
+          end
+          if masquerade
+            valid_attributes = []
+            valid_attributes << ["name",embed_name]
+            valid_attributes << ["value",embed_value]
+          end
+          @stack.push(:keep)
+        end
+        # End validation action
+      elsif tag.action.eql?(Policy::ACTION_TRUNCATE)
+        @stack.push(:truncate)
+      else
+        @handler.errors << ScanMessage.new(ScanMessage::ERROR_TAG_DISALLOWED,name)
+        @stack.push(:remove)
+      end
+      # We now know wether to keep or truncat this tag
+      if @stack.peek?(:truncate)
+        @handler.start_element(name,[])
+      elsif @stack.peek?(:keep)
+        @handler.start_element(name,valid_attributes)
+      end
+    end
+
+    def start_element_namespace(name,attrs=[],prefix = nil, uri = nil, ns = nil)
+      start_element(name,attrs)
+    end
+
+    def end_element_namespace(name,prefix,uri)
+      end_element(name)
+    end
+
+    # Add character data to the current tag
+    def characters(text)
+      unless text =~ /\S/ # skip whitespace
+        return unless @policy.directive(Policy::PRESERVE_SPACE) =~ /true/i
+      end
+      if @stack.peek?(:css)
+        @css_content << text
+      elsif !@stack.peek?(:remove)
+        @handler.characters(text)
+      end
+    end
+
+    # End an elements, will raise an error on a loose tag
+    def end_element(name)
+      if @stack.peek?(:remove)
+        @stack.pop
+      elsif @stack.peek?(:filter)
+        @stack.pop
+      elsif @stack.peek?(:css)
+        @stack.pop
+        # Do css stuff here
+        # begin
+        #   results = @css_scanner.scan_tyle_sheet(@css_content,@policy.max_input)
+        #   @handler.errors << results.errors
+        #   @handler.errors.flatten!
+        #   unless results.clean_html.nil? or results.clean_html.empty?
+        #     @handler.start_element(element,css_attributes)
+        #     @handler.characters results.clean_html
+        #     @handler.end_element(element)
+        #   end
+        # rescue Exception => e
+        #   @handler.errors << ScanMessage.new(ScanMessage::ERROR_CSS_TAG_MALFORMED,name,@handler.encode_text(@css_content))
+        # ensure
+        # @css_content = nil
+        # @css_attributes = nil
+      else
+        @stack.pop
+        @handler.end_element(name)
+      end
+    end
+
+    # Add cdata a cdata block
+    def cdata_block(text)
+      if @stack.peek?(:css)
+        @css_content << text
+      elsif !@stack.peek?(:remove)
+        @handler.characters(text)
+      else
+        @handler.cdata(@handler.encode_text(text)) unless @stack.peek == :remove
+      end
+    end
+  end
+end